darksiderat | 5a7a3a4a87d2ff48c8997a4d3fd4961894b3f63ea29cb8cbcf0a6f77702d09b4

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:06

Target
2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe
Size 223KB
Sample260809-hw97ssshkb
SHA256 5a7a3a4a87d2ff48c8997a4d3fd4961894b3f63ea29cb8cbcf0a6f77702d09b4
MD5 02f7f83a0928e2d98172f05758b69772
SHA1 4a61422e8b8de47792e4efe4ad33e448bf26c411
SHA512 e4650bc342ab836e43b05ddccee4e4a4afbae169942a1766bee0bd6473dbdb5fa140476ee74151a237f2ddf4556248b14d8bcdeb5f479a96a05ec00a4e5fd719
SSDEEP 3072:ekGYAuWbuMUPkWql9XmQHogVFO4sDEvio4uwaebbd5cQClGXGDCUY6+WSvm:ADXUcvX2SVFOR4JbkulGYT
TLSH
T163249E22ABA969F8D07A817484225B05E777BC310278EF2F526435571F373C29D3AF22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Family: DarkSideRAT
DarkSideRAT is a remote access trojan.
trojan darksiderat

Detects DarkSideRAT 2 IoCs

resource	yara_rule
behavioral2/memory/2832-1-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat
behavioral2/memory/2832-2-0x0000000140000000-0x0000000140015000-memory.dmp	family_darksiderat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5968 set thread context of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88
PID 5968 wrote to memory of 2832	5968	2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5968
- C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f7f83a0928e2d98172f05758b69772_icedid_njrat_vidar.exe"
  2⤵
  PID:2832

memory/2832-1-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/2832-2-0x0000000140000000-0x0000000140015000-memory.dmp

Download

memory/5968-0-0x0000000140000000-0x0000000140048000-memory.dmp

Download

memory/5968-3-0x0000000140000000-0x0000000140048000-memory.dmp

Download